How to troubleshoot serverclass.conf error "Attribute unsupported by UI: stanza=serverClass:PerfmonManage...reason='2+ distinct values at this level'"?

[bpitts2]

Hello all,

This morning I logged into our deployment server and found a message that the forwarder manager screen was in 'read only' mode because some of our serverclass.conf settings were not supported.

Ok, not a big deal, right? I figured I would just browse the config, find the error and correct it.

The error message that was thrown is below:

11-16-2015 12:08:18.789 -0500 WARN  DS_DC_Common - Attribute unsupported by UI: stanza=serverClass:PerfmonManage property=restartSplunkd reason='2+ distinct values at this level'

Well, the problem is that my D:\Program Files\Splunk\etc\system\local\serverclass.conf doesn't contain any stanza named "serverClass:PerfmonManage"

Is there an easy way to figure out where Splunk has picked up "serverClass:PerfmonManage", maybe in another conf that I'm not thinking of?

Thanks,
BPitts2

[dgrubb_splunk · Accepted solution]

Use btool to see the config...

./splunk cmd btool serverclass list --debug

then track down the serverclass in question with the merged btool output.

[bpitts2]

Ah, btool, I thought that might be the right direction. I'll take a look. Thanks!